GOOGLE_CLIENT_ID=xxx.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=GOCSPX-xxx

export async function GET() {
  const params = new URLSearchParams({
    client_id: process.env.GOOGLE_CLIENT_ID!,
    redirect_uri: `${process.env.NEXT_PUBLIC_URL}/api/auth/callback/google`,
    response_type: 'code',
    scope: 'openid email profile',
    access_type: 'offline',
    prompt: 'consent',
  })

  return Response.redirect(
    `https://accounts.google.com/o/oauth2/v2/auth?${params}`
  )
}

export async function GET(req: Request) {
  const { searchParams } = new URL(req.url)
  const code = searchParams.get('code')

  if (!code) {
    return Response.redirect('/login?error=no_code')
  }

  // 用 code 换取 token
  const tokenResponse = await fetch('https://oauth2.googleapis.com/token', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
    },
    body: new URLSearchParams({
      client_id: process.env.GOOGLE_CLIENT_ID!,
      client_secret: process.env.GOOGLE_CLIENT_SECRET!,
      code,
      grant_type: 'authorization_code',
      redirect_uri: `${process.env.NEXT_PUBLIC_URL}/api/auth/callback/google`,
    }),
  })

  const tokens = await tokenResponse.json()
  const { access_token, id_token } = tokens

  // 方式1：解析 id_token（推荐）
  const payload = JSON.parse(
    Buffer.from(id_token.split('.')[1], 'base64').toString()
  )

  const googleUser = {
    id: payload.sub,
    email: payload.email,
    name: payload.name,
    avatar: payload.picture,
    emailVerified: payload.email_verified,
  }

  // 方式2：调用 API 获取用户信息
  // const userResponse = await fetch(
  //   'https://www.googleapis.com/oauth2/v2/userinfo',
  //   { headers: { Authorization: `Bearer ${access_token}` } }
  // )
  // const googleUser = await userResponse.json()

  // 创建或更新用户
  const user = await db.user.upsert({
    where: { googleId: googleUser.id },
    update: {
      name: googleUser.name,
      avatar: googleUser.avatar,
    },
    create: {
      googleId: googleUser.id,
      email: googleUser.email,
      name: googleUser.name,
      avatar: googleUser.avatar,
      emailVerified: googleUser.emailVerified ? new Date() : null,
    },
  })

  // 创建 session / JWT
  // ...

  return Response.redirect('/dashboard')
}

export function GoogleLoginButton() {
  return (
    <a
      href="/api/auth/google"
      className="flex items-center gap-2 px-4 py-2 border rounded-lg hover:bg-gray-50"
    >
      <GoogleIcon />
      使用 Google 登录
    </a>
  )
}

import NextAuth from 'next-auth'
import GoogleProvider from 'next-auth/providers/google'

const handler = NextAuth({
  providers: [
    GoogleProvider({
      clientId: process.env.GOOGLE_CLIENT_ID!,
      clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
    }),
  ],
  callbacks: {
    async signIn({ user, account, profile }) {
      // 自定义登录逻辑
      return true
    },
    async session({ session, token }) {
      session.user.id = token.sub
      return session
    },
  },
})

export { handler as GET, handler as POST }

'use client'

import { useEffect } from 'react'

export function GoogleOneTap() {
  useEffect(() => {
    window.google?.accounts.id.initialize({
      client_id: process.env.NEXT_PUBLIC_GOOGLE_CLIENT_ID!,
      callback: handleCredentialResponse,
    })

    window.google?.accounts.id.prompt()
  }, [])

  async function handleCredentialResponse(response: { credential: string }) {
    // response.credential 是 id_token
    await fetch('/api/auth/google/one-tap', {
      method: 'POST',
      body: JSON.stringify({ credential: response.credential }),
    })

    window.location.href = '/dashboard'
  }

  return null
}

import { OAuth2Client } from 'google-auth-library'

const client = new OAuth2Client(process.env.GOOGLE_CLIENT_ID)

export async function POST(req: Request) {
  const { credential } = await req.json()

  const ticket = await client.verifyIdToken({
    idToken: credential,
    audience: process.env.GOOGLE_CLIENT_ID,
  })

  const payload = ticket.getPayload()!

  // 创建用户和 session
  // ...

  return Response.json({ success: true })
}